调用AWS TimeStream CreateBatchLoadTask所需的S3 IAM权限说明

搜索相关资料时未找到明确说明，自行摸索后整理出调用该API所需的完整权限配置（包含S3和TimeStream权限），分享给有需要的开发者：

{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Sid": "VisualEditor0",
          "Effect": "Allow",
          "Action": [
              "s3:PutObjectAcl",
              "s3:PutObject",
              "s3:GetObject"
          ],
          "Resource": "arn:aws:s3:::*/*"
      },
      {
          "Sid": "VisualEditor1",
          "Effect": "Allow",
          "Action": [
              "s3:ListBucket",
              "s3:GetBucketAcl"
          ],
          "Resource": "arn:aws:s3:::*"
      },
      {
          "Sid": "VisualEditor2",
          "Effect": "Allow",
          "Action": [
              "timestream:WriteRecords",
              "timestream:CreateBatchLoadTask"
          ],
          "Resource": "arn:aws:timestream:*:*:database/*/table/*"
      },
      {
          "Sid": "VisualEditor3",
          "Effect": "Allow",
          "Action": [
              "timestream:DescribeEndpoints"
          ],
          "Resource": "*"
      }
  ]
}

需要注意的是，使用CLI或Lambda调用该API时，若权限不足，错误信息仅会提示"S3桶访问被禁止"，不会明确指出具体缺失的权限，这会给权限排查带来一定难度。

内容的提问来源于stack exchange，提问作者Dylan Bartley